✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
2025 Surge in Supply Chain Attacks Hits GitHub Actions: What Every DevSecOps Leader Must Know
In 2025, a surge in supply chain attacks targeted GitHub Actions, leveraging insecure workflows and misconfigured secrets to inject malicious code into the software development pipeline. Attackers exploited open source dependencies and automation gaps, enabling lateral movement and data theft across multiple organizations using compromised CI/CD environments. The incident, revealed through coordinated research at Black Hat Europe, highlighted how adversaries can escalate privileges and bypass traditional defenses by targeting both public and private repositories, resulting in widespread risk for organizations with weak DevSecOps controls. This incident underscores a pronounced trend: attackers are increasingly focusing on automated development environments and supply chains, not just production workloads. With more organizations adopting GitHub Actions and similar platforms, visibility, zero trust segmentation, and secure automation practices are now critical to thwart sophisticated threat actors targeting the software supply chain.
6 months ago
Kill Chain
Eighth Chrome Zero-Day of 2025: Google Issues Emergency Patch Amid Active Exploitation
In early 2025, Google addressed its eighth actively exploited zero-day vulnerability in Chrome within the year, releasing an emergency update after threat actors leveraged the flaw to bypass browser security and execute malicious code. Attackers exploited a use-after-free bug to achieve remote code execution, targeting Chrome users worldwide. Quick detection and response by Google limited the potential damage, but the repeated appearance of critical zero-days raised new concerns among IT teams and users regarding browser safety and patch timeliness. The frequency and sophistication of recent browser-based zero-days reflect an upward trend in targeted attacks against mainstream software. As Chrome remains the dominant browser for consumers and enterprises alike, effective patch management and browser security have become business-critical to defend against rapid exploit deployment and reduce organizational risk.
6 months ago
Kill Chain
Google Ads Push MacOS AMOS Infostealer via ChatGPT & Grok AI Guides in 2024
In early June 2024, a threat campaign leveraged Google search advertisements to promote fraudulent ChatGPT and Grok chatbot guides targeting macOS users. Victims who clicked on these ads were redirected to malicious sites and deceived into downloading the AMOS (Atomic) infostealer malware, which harvested sensitive credentials, cryptocurrency wallets, and other private data. The campaign exemplifies the use of topical lures—capitalizing on the mainstream popularity of AI chat platforms—to facilitate widespread malware distribution, bypassing native macOS security. Attackers used SEO poisoning and social engineering tactics, making detection and attribution challenging, while infostealer payloads exfiltrated key business and personal data. This incident underscores a rising trend: infostealer campaigns exploiting interest in emerging AI technologies, with search engine ads and convincing guides serving as the primary attack vector. As macOS adoption grows in enterprises and AI tools become mainstream, businesses face escalating risks from social engineering, supply chain misuse, and evolving malware techniques exploiting trusted sites and brand searches.
6 months ago
Kill Chain
Gogs Zero-Day RCE Exploited: Hundreds of Git Servers Breached in 2024
In early June 2024, a critical and unpatched zero-day vulnerability in Gogs—an open-source, self-hosted Git service—was exploited by unnamed threat actors to achieve remote code execution on over 700 publicly accessible servers. Attackers leveraged a flaw in Gogs' authentication mechanism to gain administrative access, subsequently deploying malicious payloads and establishing persistent control over compromised systems. The campaign, detected by threat intelligence researchers, resulted in unauthorized access to sensitive development infrastructure, disruption of software delivery pipelines, and potential exposure of intellectual property and credentials. This incident underscores the escalating pace at which threat actors exploit zero-day vulnerabilities, particularly in widely adopted developer tools. The wave of attacks against Gogs highlights the urgent need for organizations to maintain up-to-date security controls and implement zero trust segmentation to limit lateral movement in cloud-native environments.
6 months ago
Kill Chain
ConsentFix: How a Clever OAuth Attack Took Over Microsoft Accounts via Azure CLI in 2024
In June 2024, a new variation of the previously-identified ClickFix attack emerged—dubbed 'ConsentFix'—targeting organizations using Microsoft Azure. Threat actors leveraged social engineering to manipulate users into granting malicious OAuth permissions via the Azure CLI tool, resulting in full account compromise without requiring user passwords or bypassing multi-factor authentication (MFA). By tricking victims into executing crafted Azure CLI commands, attackers could hijack Microsoft accounts, potentially leading to widespread access to sensitive data, misconfiguration, or further lateral movement within affected cloud environments. This attack highlights the growing sophistication of consent phishing and the increased abuse of cloud automation tools, stressing the urgent need for organizations to review OAuth permission flows and harden identity-driven security controls. Rapid evolution in attacker tactics underscores critical risks within cloud access management and the threat landscape.
6 months ago
Kill Chain
Active Exploits Target Gladinet CentreStack and Triofox Using Hard-Coded Keys
In December 2025, Gladinet's CentreStack and Triofox platforms were found to contain a critical vulnerability (CVE-2025-14611) arising from hard-coded cryptographic keys. Threat actors exploited this flaw by crafting malicious access tickets, allowing them to decrypt sensitive files—including the web.config file—and ultimately achieve remote code execution through ViewState deserialization. At least nine organizations across healthcare and technology were compromised, with attackers chaining this vulnerability with previously known flaws for greater impact. The attack flow highlights attackers' in-depth knowledge of Gladinet’s codebase and past vulnerabilities. This incident underscores the growing risks from supply chain software flaws and repeated exploitation of insecure cryptography in enterprise products. The rapid addition of this CVE to CISA’s Known Exploited Vulnerabilities catalog reflects intensifying regulatory scrutiny and a pressing need for organizations to identify and remediate insecure authentication mechanisms promptly.
6 months ago
Kill Chain
UK Slaps LastPass with £1.2M Fine for 2022 Data Breach Exposing Encrypted Vaults
In August 2022, password management provider LastPass suffered a sophisticated data breach in which attackers exploited a compromised developer account. The breach led to the exfiltration of source code, proprietary data, and encrypted password vaults for approximately 1.6 million UK users. Investigation revealed gaps in LastPass’s internal security controls and multi-factor authentication implementation, enabling lateral movement and access to critical storage environments storing user vault backups. The breach resulted in substantial reputational and regulatory consequences for LastPass, including a £1.2 million fine from the UK Information Commissioner’s Office (ICO). This incident remains significant as it highlights persistent weaknesses in cloud application security, data vault encryption, and the growing focus of regulators on consumer data privacy practices. Increased cybercriminal targeting of password management services underscores an urgent need for robust internal segmentation and encryption at all stages.
6 months ago
Kill Chain
Malicious VSCode Extensions Breach Developer Supply Chain in 2024
In early 2024, researchers uncovered a significant supply chain attack affecting the Visual Studio Code Marketplace, where 19 malicious extensions were published and actively distributed since February. These extensions, downloaded by thousands of developers worldwide, secretly harbored trojans within disguised PNG files placed in dependency folders. The attackers leveraged VSCode’s broad adoption as a developer tool to inject remote access trojans (RATs) and facilitate potential compromise of development environments and source code. Microsoft has since removed the malicious extensions, but the campaign illustrates a growing trend of targeting developer ecosystems for initial access and data exfiltration. This incident highlights the increased risk posed by third-party dependencies in software supply chains, especially as attackers shift toward platforms popular among technical professionals. The event also underscores the ongoing regulatory and compliance challenges in managing integrity and security for code repositories and developer tools.
6 months ago
Kill Chain
Notepad++ Supply Chain Attack: Malicious Updater Flaw Exposes Millions (2024)
In June 2024, Notepad++ addressed a critical security vulnerability in its updater component, WinGUp, after researchers revealed that attackers could intercept the update process and deliver malicious executables instead of authentic software updates. The flaw arose because the updater did not enforce encryption or signature verification when retrieving update packages, allowing adversaries to mount supply chain attacks through man-in-the-middle techniques. This exposed users to risk of remote code execution and allowed attackers to propagate malware under the guise of legitimate software updates. This incident highlights the growing wave of software supply chain attacks in 2024, echoing concerns from security leaders and regulators about the risks of unencrypted software delivery channels. Organizations are being urged to ensure proper code signing, encrypted update pipelines, and vigilant anomaly detection in third-party dependencies to defend against evolving threat tactics.
6 months ago
Kill Chain
Gladinet CentreStack 2024: RCE Attacks via Cryptographic Vulnerability
In early June 2024, threat actors began exploiting a previously unknown cryptographic implementation flaw in Gladinet's CentreStack and Triofox products, enabling them to remotely execute code on vulnerable servers. By leveraging crafted payloads targeting insecure cryptographic validation, attackers bypassed authentication mechanisms and gained unauthorized access to sensitive file sharing environments. This led to potential exposure of confidential data, lateral movement, and service disruption for affected organizations, particularly those relying on CentreStack for enterprise file sharing and remote access. This incident highlights the risks of cryptographic implementation errors and the urgent need for patch management, especially for third-party cloud and SaaS solutions. As attackers increasingly weaponize zero-day flaws in commonly used remote file access platforms, enterprises must prioritize robust monitoring and rapid response strategies.
6 months ago
Kill Chain
Gogs Zero-Day Exploit Compromises 700+ Cloud Instances in 2025
In July 2025, more than 700 internet-exposed instances of Gogs, a popular self-hosted Git service, were compromised via exploitation of an unpatched zero-day vulnerability (CVE-2025-8110). Threat actors took advantage of improper symbolic link handling in the file update API, enabling arbitrary file overwrite and remote code execution. Attackers deployed Supershell-based malware through a multi-step process to gain server access, leaving behind uniquely-named repositories and operating in a 'smash-and-grab' campaign style. The campaign exploited a previously patched flaw (CVE-2024-55947) bypass, emphasizing the importance of patch management and reducing attack surface exposure for critical developer infrastructure. This incident is highly relevant as it highlights an ongoing surge in attacks targeting developer and DevOps tools, exposing how rapidly adversaries adapt to security patch cycles and leverage weaknesses in open-source environments. GIT system supply chain risks and attacker agility mandate urgent focus on threat detection, cloud workload security, and privileged access management.
6 months ago
Kill Chain
React2Shell (CVE-2025-55182): New React Server Components Flaw Under Active Attack
In December 2025, attackers rapidly weaponized a critical deserialization vulnerability (CVE-2025-55182, "React2Shell") in React Server Components (RSC), enabling remote code execution on web servers running unpatched React libraries. Threat actors exploited the flaw—scoring a CVSS 10.0—by sending serialized payloads in POST requests, executing arbitrary commands, deploying malware, and exfiltrating credentials. Infections observed include crypto-miners, Mirai/Gafgyt bots, and the advanced RondoDox botnet targeting both Linux servers and IoT devices. Exploit activity began within hours of disclosure, with a sharp increase in attempts against internet-facing systems. This incident highlights the increasing speed at which proof-of-concept exploits are operationalized in the wild, emphasizing risks of deserialization vulnerabilities and dependency hygiene in modern web application stacks. Supply chain and cloud-centric attacks leveraging similar TTPs are expected to become more common, placing organizations with weak patch cycles at heightened risk.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports